CRMA Evaluating Risk Culture 2 — Questions and Answers
Question 1: Which metric is MOST useful when quantitatively assessing risk culture strength across business units?
- Near-miss reporting rates compared across units (Correct answer)
- Total revenue generated per unit
- Number of employees per manager
- Percentage of budget spent on compliance
Correct answer: Near-miss reporting rates compared across units
Near-miss reporting rates reveal willingness to surface risk events, a direct behavioral indicator of risk culture strength.
Question 2: When conducting a risk culture survey, which design element most reduces social desirability bias in responses?
- Guaranteed anonymity for respondents (Correct answer)
- Using a five-point Likert scale
- Including senior leadership in the survey sample
- Administering the survey annually
Correct answer: Guaranteed anonymity for respondents
Guaranteed anonymity reduces respondents' tendency to answer in ways they believe are socially acceptable rather than truthfully.
Question 3: A CRMA practitioner notices that formal risk policies are strong but actual employee behavior contradicts them. This gap is best described as:
- Espoused values versus values-in-use (Correct answer)
- Policy obsolescence
- Regulatory noncompliance
- Risk appetite misalignment
Correct answer: Espoused values versus values-in-use
The gap between stated organizational values and actual behavior reflects the difference between espoused values and values-in-use.
Question 4: Which internal audit activity provides the STRONGEST evidence of tone at the top regarding risk culture?
- Observing whether executives attend and actively engage in risk committee meetings (Correct answer)
- Reviewing the wording of the company's published risk appetite statement
- Counting the number of risk training hours completed by executives
- Analyzing the risk section of the annual report
Correct answer: Observing whether executives attend and actively engage in risk committee meetings
Direct behavioral observation of executive engagement in risk governance provides stronger evidence than documents or reported metrics alone.
Question 5: An organization rewards employees who exceed revenue targets regardless of the risk methods used. What risk culture problem does this indicate?
- Incentive structures that undermine risk-aware behavior (Correct answer)
- Insufficient risk training programs
- Inadequate segregation of duties
- Poor risk appetite documentation
Correct answer: Incentive structures that undermine risk-aware behavior
When incentive systems reward results without regard to risk behavior, they send cultural signals that undermine the organization's stated risk values.
Question 6: Which of the following is a leading indicator of deteriorating risk culture?
- Increasing number of employees bypassing established controls (Correct answer)
- A recent increase in total assets
- Growing headcount in the risk function
- Completion of a new enterprise risk framework
Correct answer: Increasing number of employees bypassing established controls
Control bypass behavior is a leading behavioral indicator that risk culture is weakening before formal metrics or losses materialize.
Question 7: When evaluating risk culture, focus groups are preferred over surveys in situations where:
- Rich contextual understanding of attitudes is needed and sample size is small (Correct answer)
- Broad quantitative data across thousands of employees is required
- Anonymous statistical benchmarking is the primary goal
- Regulatory reporting deadlines are imminent
Correct answer: Rich contextual understanding of attitudes is needed and sample size is small
Focus groups enable qualitative depth and contextual nuance that surveys cannot capture, making them ideal for smaller groups where understanding the 'why' matters.
CRMA Evaluating Risk Culture 2
Which metric is MOST useful when quantitatively assessing risk culture strength across business units?